Which versions of CHARX SEC-3000 are affected by CVE-2026-44098?

Phoenix Contact CHARX SEC EV charging controllers (models SEC-3000, SEC-3100, SEC-3050, SEC-3150 running versions 1.0.0-1.9.0) contain a critical OS command injection vulnerability (CVE-2026-44098,…. A patch is available.

How to fix or mitigate CVE-2026-44098?

Within 24 hours, conduct a full inventory of Phoenix Contact CHARX SEC charging controllers to identify systems running vulnerable versions 1.0.0 through 1.9.0 and audit firewall rules and network access controls protecting the OCPP backend connection. Within 7 days, apply vendor patch version 1.9.1 to all affected charging controllers, staging the update in a non-production environment first to validate compatibility. Within 30 days, verify 100% patch deployment across all inventory, confirm all systems are running version 1.9.1 or later, and conduct a 30-day audit of OCPP backend access logs for unauthorized command attempts.

CHARX SEC-3000 CVE-2026-44098

Q: What is the CVSS score of CVE-2026-44098?

CVE-2026-44098 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.4%.

EUVD-2026-51033 HIGH

OS Command Injection (CWE-78)

2026-07-30 info@cert.vde.com

GHSA-c6hj-8gx4-32qh

Command Injection

8.8

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.0 HIGH

Network-reachable and unauthenticated at the OCPP layer (PR:N) but requires first bypassing a firewall to control the backend, raising complexity to AC:H; command injection interrupts charging so A:H with limited C/I as charx-oa.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:35 vuln.today

Patch available

Jul 30, 2026 - 08:03 EUVD

CVE Published

Jul 30, 2026 - 07:16 cve.org

HIGH 8.8

DescriptionCVE.org

This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted.

AnalysisAI

OS command injection in Phoenix Contact CHARX SEC EV charging controllers allows an unauthenticated remote attacker who controls the OCPP backend (reached via a firewall-bypass) to execute arbitrary commands as the limited charx-oa user, potentially interrupting vehicle charging. It affects CHARX SEC-3000, SEC-3100, SEC-3050 and SEC-3150 versions 1.0.0 up to but not including 1.9.1, and is fixed in 1.9.1. There is no public exploit identified at time of analysis, and the CVSS 4.0 base score is 8.8 (High).

Technical ContextAI

The affected devices are CHARX SEC series charging controllers used to manage AC/DC electric-vehicle charging stations, which communicate with a central management system using the Open Charge Point Protocol (OCPP), the standard WebSocket/SOAP-based backend protocol for EV charge points. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning data received over the OCPP channel is passed into a system shell without adequate sanitization, allowing crafted input to break out into shell command execution. Commands run in the context of the limited service account charx-oa rather than root, which constrains but does not eliminate impact.

RemediationAI

Vendor-released patch: upgrade all affected CHARX SEC-3000, SEC-3100, SEC-3050 and SEC-3150 devices to firmware version 1.9.1 or later, as described in the CERT@VDE advisory VDE-2026-008 (https://www.certvde.com/en/advisories/VDE-2026-008/). Because exploitation requires the attacker to reach and control the OCPP backend by bypassing a firewall, the primary compensating control until patching is to harden network segmentation so the charge controller only accepts OCPP connections from the trusted, authenticated management backend - restrict inbound OCPP (WebSocket) reachability with strict allow-lists and verify the firewall bypass path referenced in the advisory is closed, at the cost of ensuring legitimate backend connectivity is not disrupted. Enforcing TLS with backend certificate validation on the OCPP channel further reduces the risk of an untrusted party impersonating the backend.